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(54) System and method for generating alerts through multi-variate data assessment 



(57) This invention provides a system (28) and 
method for generating alerts through multi-variate as- 
sessment. A normalizer (30) normalizes data obtained 
from a process. A classifier (32) classifies the correlated 
data in a multi-dimensional space defined for the varia- 
bles in the process. The normalized data are classified 
into a normal cluster indicative of normal operating con- 
ditions and at least one alert cluster each indicative of 



alert conditions. An alert verifier (34) verifies correlated 
data classified as an alert condition. In another embod- 
iment of this invention, a tracker is used for addressing 
drifting data sets that arise in the process over time 
which allows the adaptation of classifiers to the shifted 
state. In a third embodiment, the multi-variate generator 
is used in parallel with a trend performance analysis tool 
to validate alerts generated therefrom. 
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Description 

[0001] The present invention relates generally to trend performance analysis and more particularly to generating 
alerts for data obtained from a process through automated multi-variate data assessment. 

s [0002] A trend performance analysis tool is typically used to monitor sensor data and parameter settings for a tech- 
nical process. One type of technical process where a trend performance analysis tool is used is with aircraft engines. 
In this example, engine data are sampled from an airplane at different times of the flight and transmitted to a ground 
station. The data are collected and distributed to an aircraft engine expert for that particular airplane fleet. The data 
are preprocessed and evaluated by a trend performance analysis tool. In particular, the trend performance analysis 

10 tool monitors a multitude of engine variables. Data for each variable are compared against trending baseline data. If 
the data for a particular variable exceed a predetermined threshold limit and the data are not considered to be an 
outlier, then the trend performance analysis tool issues an alert. Typically, the predetermined alert threshold limit for 
each variable is set at a level that is below a limit that would generate a fault warning flag in the cockpit of the airplane. 
In particular, the predetermined alert threshold limit for each variable is at a level that would create an awareness of 

*5 a potential problem before it turns into an event that could result in a revenue loss for the airplane. Examples of potential 
revenue loss situations are a grounding of an airplane, damage to an engine, departure delay, etc. 
[0003] After an alert has been issued by the trend performance analysis tool, the aircraft engine expert examines 
trend charts for each of the variables in order to determine if an event has truly occurred which warrants further action. 
If the data in any of the trend charts are suspicious, then the aircraft engine expert notifies the fleet management of 

20 that particular airplane and suggests actions to further diagnose and/or actions to correct any causes for the alert. 
Examples of possible actions are borescoping the engine, engine washing, overhauling the engine, etc. A problem 
with this approach is that many alerts are generated which are false and do not warrant further diagnostic or corrective 
actions. There are a number of reasons for the high number of false alerts being issued. One is that the data quality 
varies considerably between different engines. Another reason is that predetermined alert threshold levels for a variable 

25 are preset globally and not selected for an individual airplane. Other reasons for issuing an excessive number of alerts 
are noise generated from poorly calibrated and deteriorating sensors, the use of faulty data acquisition systems, and 
slow wear of the engine which results in a constant change of normal operating conditions. 

[0004] If too many alerts are generated, then the aircraft engine expert has to constantly examine the trend charts 
to eliminate the false alerts from the true alerts. Constantly examining the trend charts becomes a very time consuming 
30 task when there is a large number of engines to monitor as typically is the case for a large fleet of airplanes. In addition, 
the expert's senses may become dulled to the true alerts due to the large amount of false positive alerts. Therefore, 
there is a need for a system and method that produces less false positive alerts and can assist in reducing the excessive 
number of false alerts generated by a trend performance analysis tool. 

[0005] This invention is able to generate alerts through simultaneous assessment of several engine variables and 
35 by learning changing system behavior. First, data are processed by normalization according to a set of normalization 
parameters. In particular, variables defined for the process are normalized individually. The normalized data for each 
process variable are then assessed simultaneously. In particular, mufli-variate clustering is used to classify the nor- 
malized data in a multi-dimensional space defined for the process variables. The normalized data are classified into 
a cluster indicative of normal operating conditions and one or more alert clusters indicative of alert conditions. The 
40 clusters are of non-uniform and non-linear degrading size and shape. In particular, the boundaries between the clusters 
are non crisp, such that the degree of membership for a cluster is largest at the center. Data classified as being in one 
of the alert clusters are then verified to make sure that the data are not a false alert. Suspected alerts are verified by 
determining the level of vigilance for each reading. Each reading with a raised vigilance level is indicative of suspicious 
data. Each consecutive suspicious reading after the first suspicious reading raises the degree of vigilance. If a prede- 
4S termined number of consecutive vigilance readings has been generated, then the suspected alert is considered to be 
a true alert and not a false alert. The cluster locations and shapes are then updated to account for slow system changes 
which are expected by the system, e.g., due to wear. 

[0006] In accordance with one embodiment of this invention, there is provided a system and a method for generating 
alerts from data obtained from a process. In this embodiment, a normalizer normalizes the data. A classifier classifies 
so the normalized data in a multi-dimensional space defined for variables in the process. The normalized data are classified 
into a normal cluster indicative of normal operating conditions and at least one alert cluster each indicative of alert 
conditions. An alert verifier verifies data classified as an alert condition. 

[0007] In accordance with a second embodiment of this invention, there is provided a system and method for gen- 
erating alerts from data obtained from a process. In this embodiment, a normalizer normalizes the data. A tracker tracks 
55 the normalized data for drifts that arise over time in the process. A classifier classifies the normalized data in a multi- 
dimensional space defined for variables in the process. The normalized data are classified into a normal cluster indic- 
ative of normal operating conditions and at least one alert cluster each indicative of alert conditions. An alert verifier 
verifies data classified as an alert condition. 
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[0008] In accordance with a third embodiment of this invention, there is provided a system and method for validating 
an alert generated from a trend performance analysis tool used to monitor data obtained from a process. In this em- 
bodiment, a normal izer normalizes the data monitored by the trend performance analysis tool. A classifier classifies 
the normalized data in a multi-dimensional space defined for variables in the process. The normalized data are classified 
s into a normal cluster indicative of normal operating conditions and at least one alert cluster each indicative of alert 
conditions. An alert verifier verifies data classified as an alert condition. The verified alert condition is an indication that 
the alert generated from the trend performance analysis tool is valid. 

[0009] Embodiments of the invention will now be described, by way of example, with reference to the accompanying 
drawings, in which: - 

10 

Fig. 1 shows a block diagram of a system for monitoring and maintaining an aircraft engine according to the prior art; 

Fig. 2 shows a block diagram of a system for monitoring and maintaining an aircraft engine according to this 
invention; 

15 

Fig. 3 shows a more detailed view of a multi-variate alert generator shown in Fig. 2; 
Fig. 4 shows the normalized data obtained from an aircraft A and the normalized data from an aircraft B; 
20 Fig. 5 shows a plot of some engine variables correlated with each other; 

Fig. 6 shows an example of a fuzzy cluster distribution plot between engine variables; 
Fig. 7 shows a flow chart setting forth the steps performed by the system shown in Fig. 2; 

25 

Fig. 8 shows an alternative embodiment of the multi-variate alert generator shown in Fig. 3; 

Fig. 9 shows a graph of the tracking of two aircraft engine variables over a period of time according to the embod- 
iment shown in Fig. 8; 

30 

Fig. 10 shows a block diagram of a system for monitoring and maintaining an aircraft engine according to another 
embodiment of this invention; 

Fig. 1 1 shows a more detailed view of the multi-variate alert generator used for validating alerts in a trend perform- 
35 ance analysis tool; 

Fig. 12 shows a flow chart setting forth the steps performed by the system shown in Fig. 10; and 

Fig. 1 3 shows another embodiment of the multi-variate alert generator in use with the trend performance analysis 
40 tool. 

[0010] In this invention, the system and method for generating alerts through multi-variate data assessment are 
described with reference to an aircraft engine used by an aircraft such as an airplane. Although this invention is de- 
scribed with reference to an aircraft engine, the system and method for generating alerts can be used in conjunction 

45 with any system such as a turbine, a power system, a locomotive, a chemical or mechanical process plant, or another 
process which generates sensor data where it is desirable to monitor or diagnose system behavior. Fig. 1 shows a 
block diagram of a system 10 for monitoring and maintaining an aircraft engine 12 according to the prior art. In this 
system 10, engine data are sampled from the aircraft engine 12 from an airplane 14. The engine data are sampled at 
different times of the flight such as during the take-off, the climb and the cruise. The engine data are transmitted in 

so flight to a centralized data center and stored in a database 16. The data are then collected, distributed and preprocessed 
by a preprocessor 17. 

[0011] After preprocessing, the data are evaluated by a trend performance analysis tool 18 which monitors a multitude 
of engine variables. The trend performance analysis tool 18 may be any general purpose trend performance analysis 
tool that can monitor on-line sensor data and variables of a technical process. Data for each variable are compared 
55 against trending baseline data. If the data for a particular variable exceed a predetermined threshold limit, then the 
trend performance analysis tool 18 issues an alert to a remote service unit 20. An alert is indicative of a failure, a fault 
condition, or symptoms of an incipient failure condition. An aircraft engine expert located at the remote service unit 
monitors trend charts and alerts generated by the trend performance analysis tool 18. The aircraft engine expert then 



3 



EP0 971 321 A2 



decides whether a true alert exists and generates a report to a fleet management unit 22. If the report suggests that 
remedial or diagnostic actions are needed, then personnel at the fleet management unit 22 prepare a schedule of the 
suggested actions. Maintenance personnel 24 then perform the actions (e.g., borescoping the engine, engine washing, 
overhauling the engine) as set forth in the schedule prepared by the fleet management unit 22. 

5 [0012] As mentioned above, one of the problems associated with the system 10 for monitoring and maintaining an 
aircraft engine according to the prior art is that there are many alerts generated from the trend performance analysis 
tool 18 which are false and do not further diagnostic or corrective actions. When too many alerts are generated the 
aircraft engine expert has to constantly examine the trend charts to distinguish the false alerts from the true alerts. 
Constantly examining the trend charts is a very time consuming task for the aircraft engine expert, since the expert 

10 typically has the responsibility of monitoring a large number of engines for a particular fleet. In addition, it may cloud 
the expert's attentiveness for true alerts. 

[001 3] Fig. 2 shows a block diagram of a system 26 for monitoring and maintaining an aircraft engine according to 
this invention. In this embodiment, false alerts are generated by a multi-variate alert generator 28. The multi-variate 
alert generator 28 first normalizes data obtained from the aircraft engine 1 2 according to an initialization set. In particular, 

15 variables defined for the aircraft engine are normalized individually. The aircraft engine variables that are normalized 
are delta exhaust gas temperature (dEGT), which is the deviation from the baseline EGT fuel flow (WF), core speed 
(N2), and EGT divergence, which is the difference of the EGT between the mean of EGT of all engines and the EGT 
of the engine in question. These variables are illustrative of some of the aircraft engine variables that can be normalized 
in this invention and are not an exhaustive list. The multi-variate alert generator 28 assesses the normalized data for 

20 the aircraft engine variables simultaneously, instead of one process variable at a time. In particular, the alert generator 
28 uses multi-variate clusters to classify the normalized data in a multi-dimensional space defined for the engine var- 
iables. The normalized data are classified into a normal cluster indicative of normal operating conditions and at least 
one alert cluster each indicative of an alert condition. The clusters are of non-uniform and non-linear degrading size 
and shape. Moreover, the boundaries between the clusters are non crisp, such that the degree of membership for a 

25 cluster is largest at the center. Data classified as being mostly in an alert cluster are then verified to make sure that 
the data are not a false alert. Alerts are verified by determining the level of vigilance for each reading. Each reading 
with a vigilance level is indicative of suspicious data. Each consecutive reading that falls mostly into the alert cluster 
after the suspicious reading raises a certain degree of vigilance. If a predetermined number of consecutive raised 
vigilance readings have been generated, then it is considered to be a true alert and not a false alert. 

30 [001 4] Fig. 3 shows a more detailed view of the multi-variate alert generator 28. The multi-variate alert generator 28 
comprises a normal izer 30 that normalizes engine variable data obtained from the database 1 6. A classifier 32 classifies 
the normalized data in a multi-dimensional variable space defined for the aircraft engine 12. Preferably, the multi- 
dimensional variable space comprises the dEGT, WF, N2, and EGT divergence variables. The classifier 32 classifies 
the normalized data into a normal cluster indicative of normal operating conditions and at least one alert cluster each 

35 indicative of alert conditions. An alert verifier 34 verifies the data classified as an alert condition. The aircraft engine 
expert located at the remote service unit 20 then generates a report to the fleet management unit 22 which suggests 
diagnostic and/or remedial actions to be taken. The normalizer 30, the classifier 32, and the alert verifier 34 of the 
multi-variate alert generator 28 are embedded in a computer such as a workstation. However other types of computers 
can be used such as a mainframe, a minicomputer, a microcomputer, or a supercomputer. The algorithms performed 

40 in the normalizer 30, the classifier 32, and the alert verifier 34 are programmed in VBasic, C++ and MATLAB, but other 
languages such as JAVA may be used. 

[0015] The normalizer 30 normalizes the engine data individually for each engine variable (i.e., dEGT, WF, N2, and 
EGT divergence) according to normalizing parameters. In particular, a user specified, predetermined number of initial 
data readings for each variable which are validated to be "normar (e.g., through supervision) are used to obtain the 
45 normalization parameters. All following data readings are then scaled according to the normalization parameters. While 
several normalization procedures can be used, the preferred one is governed by the equation: 



50 



(1) 



wherein 



Xnormafized te tne normalized variable; 
x is the raw reading; 

*max & toe maximum value of the data within the initialization set; and 
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x mjn is the minimum value of the data within the initialization set. 

[0016] Normalization of the engine data allows a comparison of data which are subject to different calibration or 
constraints like minor design variations or material variations. In the case of the aircraft engine example, it allows 

5 comparison of different aircraft engines that are in different states of wear and that have differently tuned variables. 
An underlying basis of the normalization is that particular failures have directional information which is retained over 
different engines and even engine families. For example, a variable bleed variable (VBV) failure results in increases 
of dEGT, WF, N2, and EGT divergence. On the other hand, a failure of a different component, e.g., a failure of a C- 
clip, will result in an increase of dEGT, WF, and EGT divergence, while N2 will drop. These characteristic changes can 

10 be seen regardless of the differences in wear or other variations mentioned above. The normalization also provides a 
role in initializing the clusters after engine changes, controller changes, major maintenance, etc. have been performed, 
which usually all involve the change of engine parameters. The normalization provides a semi-automated mechanism 
to calibrate the engine to new parameter settings. The first n data points, where n is a number to be specified by the 
user, have to be of type "normal" and have to be verified by the user. Fig. 4 shows the normalized data obtained from 

is an aircraft A and the normalized data from an aircraft B. 

[0017] The classification of the normalized data in a multi-dimensional variable space by the classifier 32 takes 
advantage of partially redundant information inherent to the aircraft engine. For example, engine variables such as 
dEGT, WF, N2, and EGT divergence are correlated such that particular failure conditions for each show up in changes 
of several of the other variables. Thus, a rapid shift of dEGT, WF, N2, and EGT divergence will correlate into a char- 

20 acteristically different region. The presence of an alert condition, such as a rapid change of dEGT caused by a variable 
bleed valve (VBV) being stuck open, results in a change of some engine variables, which shows up in an alert cluster 
while normal behavior will appear in a cluster labeled ■normar. Fig. 5 shows an example of some engine variable data 
plotted against each other. In particular, Fig. 5 shows dEGT data correlated with N2 data. Moreover Fig. 5 shows that 
when the engine variable data are plotted against each other, data of type "normal" and data of type "alert" fall largely 

25 into separate regions. 

[0018] In addition, it can be seen that data from the normal class and the alert class are found in an overlapping 
region. Therefore, the clusters from different classes in Fig. 5 are also overlapping. To resolve this ambiguity, the 
boundaries of the clusters are not crisp. Rather, cluster membership varies and is largest at the center and smaller 
further away from the center. The degradation is typically (but not necessarily) carried out in a non-linear decreasing 

30 slope. In the overlapping region, data are part of both classes. This gains a suppression of noise at the boundaries at 
the expense of solution crispness. There are a number of functions which perform this task. In this invention, fuzzy 
clusters are used, however, other techniques such as radial basis functions may be used. In a higher dimension space, 
the fuzzy clusters take the shape of an irregularly shaped hyper-ellipsoid. An example of a cluster distribution plot 
showing soft boundaries between engine variables is shown in Fig. 6. 

55 [001 9] The classifier 32 uses fuzzy clustering techniques such as fuzzy k-means and fuzzy knn clustering to provide 
a soft boundary of any cluster. Fuzzy k-means clustering classifies incoming data partially into k clusters, wherein the 
degree of belonging to a cluster is based on the distance to the cluster centroid. For example, incoming data that are 
closest to one of the k-clusters will have the highest degree of belonging to that particular cluster, while clusters further 
away from the data will have a lower degree of belonging. Fuzzy knn-clustering assigns degrees of belonging to a 

40 class by finding the minimum distance of the incoming data to the k nearest neighbors of a cluster. An advantage of 
using one of these fuzzy clustering techniques is that it provides a more favorable response in the presence of noise 
because misclassifications are avoided when the boundary to a cluster is tripped. 

[0020] Using Ruspini's approach, fuzzy k-means clustering is based on minimization of an objective function which 
is defined as: 



45 



n k 



50 




(2) 



wherein: 



55 



U is a set of a fuzzy k-partition of the data set; 



V is a set of k prototypes; 
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10 



x is the feature vector of the normalized data; 

v is the centroid of a cluster; 

u is the degree of membership Xj in cluster i; 

m is a weighing component which controls the fuzziness of the cluster; 



d 2 ( x J> v >) 



is an inner product metric (e.g., distance) between x y and v{, 
15 n is the number of data points; and 

k is the number of clusters. 

[0021] The classifier 32 uses a clustering algorithm to choose the initial number of clusters, k, and the initial position 
20 of these classes. Next, the degree of membership for all data is determined by using the following equation: 



25 



30 



m-l 



* = 1 



1 



(3) 



35 Next, a new centroid v f is determined using the following equation: 



40 



45 



(4) 



At this point the Uf are updated again and the cycle is repeated until a stopping criterion such as 



so 



(5) 



7=1 i=l 



S5 js obtained. 

For the fuzzy knn classifier, first the distance from the input vector to the closest neighbor is found. If the number of k 
neighbors has not yet been established, the closest neighbor is included in the set of k-nearest neighbors. If there are 
already k-nearest neighbors and the newly found neighbor is closer to the input vector than the farthest nearest neigh- 
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bor, then the farthest nearest neighbor is replaced by the newly found nearest neighbor. This process is repeated until 
all data points are evaluated. Then the membership is assigned to all k nearest neighbors using 



10 




f V 




15 



wherein 

20 x is the feature vector; 

Xj is one of the nearest neighbors; 

Uj is the degree of membership of x in cluster i; 

25 

Uy is the membership of the j-nearest neighbor in cluster I (based on distance from cluster mean or crisp); 
m is a weighing component which controls the fuzziness of the cluster; 

30 

d*(x, Xj ) 

is an inner product metric (e.g., distance) between x and x-; 

35 

k is the number of clusters; and 

the other variables are as in the fuzzy k-means approach. 

40 [0022] The fuzzy clustering can bethought of as compiled rule-based system having a plurality of rules for determining 
the status of the engine from the engine variables. An example of one such rule could be: 

If the dEQT goes up and the fuel flow WF goes up and the core speed N2 goes up and the EGT divergence goes up, 
then the reading is suspicious and therefore an alert is generated. If the reading is closer to the center of the "alerf 
cluster, it will produce the alert with more confidence than at the edge. Confidence is expressed as membership to any 
45 of the clusters. 

[0023] The alert verifier 34 verifies the data classified as an alert by using a digital filter. The digital filter forces the 
reoccurrence of several suspicious readings (i.e., data in an alert cluster), in particular, if only one suspicious reading 
is encountered, then the alert verifier 34 generates a vigilance level flag. If a second suspicious reading is encountered 
immediately afterwards, then the alert verifier 34 forces the vigilance level flag to go up. Otherwise, if the next reading 

so is normal, then the vigilance level goes down. In this case, the first suspicious reading is treated as an outlier and no 
remedial action is recommended. If a third consecutive suspicious reading is encountered, then the alert verifier 34 
forces the vigilance level flag further up. After a predetermined number of vigilance flags have been generated, then 
this is an indication that this is a true alert. Preferably, three is the predetermined number of vigilance flags that would 
generate a true alert, however, this number can be adjusted per user specifications. Once the alert verifier 34 determines 

55 that there is a true alert, then a report is generated and diagnostic and/or remedial action (s) are suggested by the 
aircraft engine remote service unit 20 and the fleet management unit 22, respectively 

[0024] Fig. 7 shows a flow chart setting forth the steps performed by the aircraft engine monitoring system 26 shown 
in Fig. 2. Engine data are sampled from the aircraft engine at 36 at different times of the flight such as during take-off, 
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climb and cruise. The engine data are transmitted to a centralized data center system at 38 and stored in a database 
at 40. The data are preprocessed at 42 by scaling the data for each engine variable to a baseline mode. After preproc- 
essing, the data are evaluated by the mufti-variate alert generator 28. In particular, the engine data are normalized 
individually for each engine variable according to normalizing parameters at 44. Next, the data are evaluated at 46 to 
5 determine to which degree the data belong to the clusters. If the confidence that the data does not belong primarily to 
the normal cluster at 48 is high, then the degree of alert or level of vigilance is determined at 50. After the degree of 
alert has been determined, then an alert report is generated at 52. The alert report is used by an aircraft engine expert 
who then suggests appropriate diagnostic and/or remedial actions. A schedule of actions is then prepared and used 
by maintenance personnel. 

io [0025] In another embodiment of this invention, the multi-variate alert generator 28 is implemented with a tracker for 
addressing drifting data sets that arise from a changing environment. Drifting data sets are a problem that is frequently 
encountered in trend performance analysis. A problem with drifting data sets is that it is difficult to classify the data. 
Often times, the location and shape of a data cluster will change with time due to the dynamic nature of the aircraft 
engine process. Normal wear such as progressive material abrasion as a result of friction, material changes due to 

is heat, particle deposition and contamination restricting flow, chemical material changes due to oxidization are some 
examples of factors that cause the normal operating conditions for a particular state of wear to change over time. 
Therefore, the cluster shape and location changes over time as well. Alerts are still seen as relatively sudden changes 
of the variables which are measured as deviations from the (slowly changing) normal state. 

[0026] Fig. 8 shows the multi-variate alert generator 28 implemented with a tracker 54. Preferably, the tracker 54 is 
20 located between the normalizer 30 and the classifier 32. The tracker 54 contains algorithms to adapt the shape and 
location of clusters. In particular, it is able to track slow drifts that arise from normal wear patterns, while retaining the 
ability to classify incoming data into the different clusters. The tracker is able to adapt the shape and location of clusters 
by first updating the memberships in the normal and alert clusters using the above mentioned Ruspini (k-means) 
approach, which determines membership values and cluster centers. No longer following Ruspini, the adaptation of 
25 the fuzzy cluster is determined by using the following: 



(7) 

* 1=1 ' 

35 

wherein: 

Xi is the data point under consideration; 
40 n is now the number of data of a sliding window over which to evaluate the membership of the clusters; 

v new W mnef * tne new cluster position; 

V oMwmner ' S * Re °^ C ^ Uster position; 

45 

a wirmer ls ^ e adaptive learning coefficient which is determined as follows: 



wherein 

55 

u winner ^ ^ e membership value of the winning cluster, and 
p is a small learning constant; 0 < p <1 . 



30 



= v oU + a - 



winner, *i 

i-\ 

m 

jL^ winner, 



otd_ 
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The adaptation of attempts to minimize the ambiguity in any given situation. More specifically, for two clusters, 
when the degree of belonging to a class is medium (ambiguous), u^^^and (the membership value of the losing 
cluster) are almost the same. In this case, a^^^ becomes the largest cluster, thus attempting to untangle the inde- 
terminate situation. For more than two clusters, since 



10 



it follows that 



y-i 



(9) 



75 



j- 1 
j*g 



(10) 



20 



and therefore 



25 



a. 



p i- 



u. — 



7=1 

/* winner / 



(11) 



30 letu ff =u w , 
thus 



-i) 



(12) 



40 



45 



SO 



55 



Instead of minimization of ambiguity, can be set to be constant or another suitable criterion can be used. 

[0027] The new cluster position reflects now the updated system state. In other words, it has adapted to the changed 
environment. New incoming data are then evaluated against the new cluster positions. This learning capability allows 
the tracking of system behavior not only when the system trajectory is known but in particular also when the behavior 
is hard or impossible to predict. 

[0028] Fig. 9 shows the tracking capability of the tracker 54 showing dEGT versus N2 data over a period of nine 
months including a software change resulting in a shift of the "normal" behavior. The V show the centra ids of cluster 
■normal' and the boxes show the centroid of the cluster "VBV alert". Over the observation period, the cluster centroid 
is updated first slowly, then after the change of the software, it is able to adapt to the new environment at the higher 
N2 as well without confusing the alert cluster with the normal cluster. Part of the reason is that there are two more 
dimensions (WF and EGT divergence) which are being evaluated. Only when a true alert condition occurs does the 
alert cluster adapt its position. 

[0029] If the knn approach is chosen for classification (instead of the kmeans approach), then the adaptation is 
accomplished by using a moving window over each data class which discards data older than the size of the window 
[0030] In another embodiment of this invention, the multi-variate alert generator is used in conjunction with the trend 
performance analysis tool to validate alerts generated therefrom. Fig. 10 shows a block diagram of a system 56 for 
monitoring and maintaining an aircraft engine according to this embodiment. In this embodiment, the multi-variate alert 
generator works in parallel with the trend performance analysis tool 18, however, the multi-variate aJert generator may 
be integrated into the tool. As in the embodiment set forth in Fig. 2, the multi-variate alert generator 28 normalizes data 
obtained from the aircraft engine 12 according to a initialization set. The multi-variate alert generator 28 then uses 
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mutti-variate clusters to classify the normalized data in a multi-dimensional space defined for the engine variables. 
Alerts are verified by determining the level of vigilance for each reading in the aforementioned manner Fig. 1 1 shows 
a more detailed view of the multivariate alert generator 28 used to validate alerts in the trend performance analysis tool. 
[0031 ] Fig. 1 2 shows a flow chart setting forth the steps performed by the aircraft engine monitoring system 56 shown 

s in Fig. 10. Engine data are sampled from the aircraft engine at 58 at different times of the flight such as during take- 
off, climb and cruise. The engine data are transmitted to a centralized data center system at 60 and stored in a database 
at 62. The data are p reprocessed at 64 by scaling the data for each engine variable to a baseline mode. After preproc- 
essing, the data are evaluated by the trend performance analysis tool at 66 where the data for each variable is compared 
against trending baseline data. If the data for a particular engine variable exceed a predetermined threshold limit, then 

10 the trend performance analysis tool issues an alert. 

[0032] At the same time the engine data are being evaluated by the trend performance analysis tool, the data are 
simultaneously evaluated by the multivariate alert generator. In particular, the engine data are normalized individually 
for each engine variable according to normalizing parameters at 68. Next, the data are evaluated at 70 to determine 
to which degree the data bebng to the clusters. If the confidence that the data does not belong primarily to the normal 

is cluster at 72 is high, then the degree of alert or level of vigilance is determined at 74. After the degree of alert has been 
determined, then an alert report is generated at 76. The alerts from the multivariate alert generator and the trend 
performance tool are then validated at 78. 

[0033] Fig. 13 shows another embodiment of the multivariate alert generator in use with the trend performance 
analysis tool. In this embodiment, the mutti-variate alert generator 28 is implemented with the tracker 54. As mentioned 
20 earlier, the tracker 54 addresses drifting data sets that arise from changing environments. In this embodiment, the 
tracker 54 operates in the same manner described with reference to Figs. 8-9. In particular, the tracker 54 tracks stow 
drifts that arise from normal wear patterns, while retaining the ability to classify incoming data into the different clusters. 
[0034] Various aspects of the invention are set out in the following numbered clauses. 

25 1. A system for generating an alert from data obtained from a process, comprising: 

a normalizer for normalizing the data; 

a classifier for classifying the normalized data in a multi-dimensional space defined for variables in the process, 
30 the normalized data being classified into a normal cluster and at least one alert cluster defined in the multi- 

dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for the 
process and the at least one alert cluster is indicative of alert conditions in the process; and 

an alert verifier for verifying data classified as an alert condition. 

35 

2. The system according to clause 1 , wherein said normalizer comprises means for scaling the data according to 
normalization parameters. 

3. The system according to clause 1, wherein the normal cluster and the at least one alert cluster are of non- 
40 uniform and non-linear degrading size and shape. 

4. The system according to clause 3, wherein boundaries between the normal cluster and the at least one alert 
cluster are non crisp. 

45 5. The system according to clause 4, wherein the shape of the normal cluster and the at least one alert cluster in 

the multi-dimensional variable space is an irregularly shaped hyper-ellipsoid. 

6. The system according to clause 1 , wherein the classification of normalized data into the normal cluster and the 
at least one alert cluster is based on the degree of confidence that the data belong to the normal cluster and the 

so at least one alert cluster. 

7. The system according to clause 1 , wherein the alert condition is representative of at least one of a failure, a 
fault condition, or symptoms of an incipient failure condition. 

55 8. The system according to clause 1 , wherein said alert verifier comprises means for generating a vigilance level 

flag after a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious 
data reading increases. 
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9. The system according to clause 8, wherein said alert verifier verifies an alert condition after a predetermined 
number of vigilance level flags have been generated. 

10. A system for generating an alert from data obtained from an aircraft engine process, comprising: 

5 

a normal izer for normalizing data obtained from said aircraft engine process; 

a classifier for classifying the normalized data in a multi-dimensional space defined for variables in the aircraft 
engine process, the normalized data being classified into a normal cluster and at least one alert cluster defined 
10 in the multi-dimensional variable space, wherein the normal cluster is indicative of normal operating conditions 

for said aircraft engine process and the at least one alert cluster is indicative of an alert condition for said 
aircraft engine process; and 



15 



an alert verifier for verifying data classified as an alert condition. 

11 . The system according to clause 10, wherein said normalizer comprises means for scaling the data according 
to normalization parameters. 

12. The system according to clause 10, wherein the normal cluster and the at least one alert cluster are of non- 
20 uniform and non-linear degrading size and shape. 

1 3. The system according to clause 1 2, wherein boundaries between the normal cluster and the at least one alert 
cluster are non crisp. 

25 14. The system according to clause 1 3, wherein the shape of the normal cluster and the at least one alert cluster 

in the mufti-dimensional variable space is an irregularly shaped hyper-ellipsoid. 

15. Ttie system according to clause 10, wherein the classification of normalized data into the normal cluster and 
the at least one alert cluster is based on the degree of confidence that the data belong to the normal cluster and 

30 the at least one alert cluster. 

16. The system according to clause 10, wherein the alert condition is representative of at least one of a failure, a 
fault condition, or symptoms of an incipient failure condition. 

35 1 7. The system according to clause 1 0, wherein the alert verifier comprises means for generating a vigilance level 

flag after a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious 
data reading increases. 

18. The system according to clause 1 7, wherein said alert verifier verifies an alert condition after a predetermined 
40 number of vigilance level flags have been generated. 

1 9. The system according to clause 10, wherein the multi-dimensional variable space comprises engine variables 
comprising delta exhaust gas temperature, fuel flow, core speed, and exhaust gas temperature divergence. 

45 20. A method for generating an alert from data obtained from a process, comprising: 

normalizing the data; 

classifying the normalized data in a multidimensional space defined for variables in the process, the normal- 
50 i Z ed data being classified into a normal cluster and at least one alert cluster defined in the multi-dimensional 

variable space, wherein the normal cluster is indicative of normal operating conditions for the process and the 
at least one alert cluster is indicative of an alert condition in the process; and 



55 



verifying the data classified as an alert condition. 

21 . The method according to clause 20, wherein said normalizing comprises scaling the data according to nor- 
malization parameters. 



11 



EP 0 971 321 A2 



22. The method according to clause 20, wherein the normal cluster and the at least one alert cluster are of non- 
uniform and non-linear degrading size and shape. 

23. The method according to clause 22, wherein boundaries between the normal cluster and the alert cluster are 
5 non crisp. 

24. The method according to clause 23, wherein the shape of the normal cluster and the at least one alert cluster 
in the multi-dimensional variable space is an irregularly shaped hyper-ellipsoid. 

10 25. The method according to clause 20, wherein the classification of normalized data into the normal cluster and 

the at least one cluster is based on the degree of confidence that the data belongs to the normal cluster and the 
at least one cluster. 

26. The method according to clause 20, wherein the alert condition is representative of at least one of a failure, a 
is fault condition, or symptoms of an incipient failure condition. 

27. The method according to clause 20, wherein said verifying an alert comprises generating a vigilance level flag 
after a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious data 
reading increases. 

20 

28. The method according to clause 27, wherein said verifying verifies an alert condition after a predetermined 
number of vigilance level flags have been issued 

29. A method for generating an alert from data obtained from an aircraft engine process, comprising: 

25 

normalizing the data obtained from said aircraft engine process; 

classifying the norma I ized data in a multi-dimensional space defined for variables in the aircraft engine process, 
the normalized data being classified into a normal cluster and at least one alert cluster defined in the mufti- 
30 dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for said 

aircraft engine process and the at least one alert cluster is indicative of an alert condition for said aircraft engine 
process; and 

verifying data classified as an alert condition. 

35 

30. The method according to clause 29, wherein said normalizing comprises scaling the data according to nor- 
malization parameters. 

31 . The method according to clause 30, wherein the normal cluster and the at least one alert cluster are of non- 
40 uniform and non-linear degrading size and shape. 

32. The method according to clause 31 , wherein boundaries between the normal cluster and the at least one alert 
cluster are non crisp. 

45 33. The method according to clause 32, wherein the shape of the normal cluster and the at least one alert cluster 

in the multi-dimensional variable space is an irregularly shaped hyper-ellipsoid. 

34. The method according to clause 29, wherein the classification of normalized data into the normal cluster and 
the at least one alert cluster is based on the degree of confidence that the data belong to the normal cluster and 

so the at least one alert cluster. 

35. The method according to clause 29, wherein the alert condition is representative of at least one of a failure, a 
fault condition, or symptoms of an incipient failure condition. 

55 36. The method according to clause 29, wherein said verifying comprises generating a vigilance level flag after a 

suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious data reading 
increases. 
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37. The method according to clause 36, wherein said verifying verifies an alert condition after a predetermined 
number of vigilance level flags have been generated. 

38. The method according to clause 29, wherein the multi-dimensional variable space comprises engine variables 
5 comprising delta exhaust gas temperature, fuel flow, core speed, and exhaust gas temperature divergence. 

39. A system for generating an alert from data obtained from a process, comprising: 
a normal izer for normalizing the data; 

10 

a tracker for tracking the normalized data for drifts that arise over time in the process; 

a classifier for classifying the normalized data in a multi-dimensional space defined for variables in the process, 
the normalized data being classified into a normal cluster and at least one alert cluster defined in the mutti- 
is dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for the 

process and the at least one alert cluster is indicative of an alert condition in the process; and 

an alert verifier for verifying data classified as an alert condition. 

20 40. The system according to clause 39, wherein said normalizer comprises means for scaling the data according 

to normalization parameters. 

41 . The system according to clause 39, wherein the normal cluster and the at least one alert cluster are of non- 
uniform and non-linear degrading size and shape. 

25 

42. The system according to clause 41 , wherein boundaries between the normal cluster and the at least one alert 
cluster are non crisp. 

43. The system according to clause 39, wherein said alert verifier comprises means for generating a vigilance level 
30 flag after a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious 

data reading increases. 

44. The system according to clause 43, wherein said alert verifier verifies an alert condition after a predetermined 
number of vigilance level flags have been generated. 

35 

45. The system according to clause 39, wherein the tracker comprises means for adapting the locations and shapes 
of the normal cluster and the at least one cluster in the multi-dimensional variable space in accordance with the 
drifting data. 

40 46. The system according to clause 45, wherein the classifier classifies incoming data in accordance with the 

adapted locations and shapes of the normal cluster and the at least one alert cluster. 

47. A system for generating an alert from data obtained from an aircraft engine process, comprising: 
45 a normalizer for normalizing data obtained from said aircraft engine process; 

a tracker for tracking the normalized data for drifts that arise over time in the aircraft engine process; 

a classifier for classifying the data in a multi-dimensional space defined for variables in the aircraft engine 
50 process, the data being classified into a normal cluster and at least one alert cluster defined in the multi- 

dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for said 
aircraft engine process and the at least one alert cluster is indicative of an alert condition for said aircraft engine 
process; and 

S5 an alert verifier for verifying data classified as an alert condition. 

48. The system according to clause 47, wherein said normalizer comprises means for scaling the data according 
to normalization parameters. 
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49. The system according to clause 47, wherein the normal cluster and the at least one alert cluster are of non- 
uniform and non-linear degrading size and shape. 

50. The system according to clause 49, wherein boundaries between the normal cluster and the at least one alert 
5 cluster are non crisp. 

51 . The system according to clause 47, wherein the alert verifier comprises means for generating a vigilance level 
flag after a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious 
data reading increases. 

10 

52. The system according to clause 51 , wherein said alert verifier verifies an alert condition after a predetermined 
number of vigilance level flags have been generated. 

53. The system according to clause 47, wherein the multi-dimensional variable space comprises engine variables 
comprising delta exhaust gas temperature, fuel flow, core speed, and exhaust gas temperature divergence. 

54. The system according to clause 47, wherein the tracker comprises means for adapting the locations and shapes 
of the normal cluster and the at least one cluster in the multi-dimensional variable space in accordance with the 
drifting data. 

20 

55. The system according to clause 54, wherein the classifier classifies incoming data in accordance with the 
adapted locations and shapes of the normal cluster and the at least one alert cluster. 

56. A method for generating an alert from data obtained from a process, comprising: 

25 

normalizing the data; 

tracking the normalized data for drifts that arise over time in the process; 

30 classifying the data in a multi-dimensional space defined for variables in the process, the normalized data 

being classified into a normal cluster and at least one alert cluster defined in the multi-dimensional variable 
space, wherein the normal cluster is indicative of normal operating conditions for the process and the at least 
one alert cluster is indicative of an alert condition in the process; and 

35 verifying the data classified as an alert condition. 

57. The method according to clause 56, wherein said normalizing comprises scaling the data according to nor- 
malization parameters. 

40 58. The method according to clause 56, wherein the normal cluster and the at least one alert cluster are of non- 

uniform and non-linear degrading size and shape. 

59. The method according to clause 58, wherein boundaries between the normal cluster and the at least one alert 
cluster are non crisp. 

45 

60. The method according to clause 56, wherein said verifying an alert comprises generating a vigilance level flag 
after a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious data 
reading increases. 

so 61 . The method according to clause 60, wherein said verifying verifies an alert condition after a predetermined 

number of vigilance level flags have been issued. 

62. The method according to clause 56, wherein said tracking comprises adapting the locations and shapes of the 
normal cluster and the at least one cluster in the multi-dimensional variable space in accordance with the drifting 

55 data. 

63. The method according to clause 62, wherein said classifying classifies incoming data in accordance with the 
adapted locations and shapes of the normal cluster and the at least one alert cluster. 
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64. A method for generating an alert from data obtained from an aircraft engine process, comprising: 
normalizing data obtained from said aircraft engine process; 

s tracking the normalized data for drifts that arise over time in the aircraft engine process; 

classifying the data in a multi-dimensional space defined for variables in the aircraft engine process, the nor- 
malized data being classified into a normal cluster and at least one alert cluster defined in the multi-dimensional 
variable space, wherein the normal cluster is indicative of normal operating conditions for said aircraft engine 
10 process and the at least one alert cluster is indicative of an alert condition for said aircraft engine process; and 

verifying data classified as an alert condition. 

65. The method according to clause 64, wherein said normalizing comprises scaling the data according to nor- 
15 malization parameters. 

66. The method according to clause 64, wherein the normal cluster and the at least one alert cluster are of non- 
uniform and non-linear degrading size and shape. 

20 67. The method according to clause 66, wherein boundaries between the normal cluster and the at least one alert 

cluster are non crisp. 

68. The method according to clause 64, wherein said verifying comprises generating a vigilance level flag after a 
suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious data reading 

25 increases. 

69. The method according to clause 68, wherein said verifying verifies an alert condition after a predetermined 
number of vigilance level flags have been generated. 

30 70. The method according to clause 64, wherein the multi-dimensional variable space comprises engine variables 

comprising delta exhaust gas temperature, fuel flow, core speed, and exhaust gas temperature divergence. 

71 . The method according to clause 64, wherein said tracking comprises adapting the locations and shapes of the 
normal cluster and the at least one cluster in the multi-dimensional variable space in accordance with the drifting 

35 data. 

72. The method according to clause 71, wherein said classifying classifies incoming data in accordance with the 
adapted locations and shapes of the normal cluster and the at least one alert cluster. 

40 73. A system for validating an alert generated from a trend performance analysis tool used to mon itor data obtained 

from a process, comprising: 

a normal izer for normalizing the data monitored by the trend performance analysis tool; 

45 a classifier for classifying the normalized data in a multi-dimensional space defined for variables in the process, 

the normalized data being classified into a normal cluster and at least one alert cluster defined in the multi- 
dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for the 
process and the at least one alert cluster is indicative of alert conditions in the process; and 

50 an alert verifier for verifying data classified as an alert condition, wherein the verified alert condition is an 

indication that the alert generated from the trend performance analysis tool is valid. 

74. The system according to clause 73, wherein said normalizer comprises means for scaling the data according 
to normalization parameters. 

55 

75. The system according to clause 73, wherein the normal cluster and the at least one alert cluster are of non- 
uniform and non-linear degrading size and shape. 
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76. The system according to clause 75, wherein boundaries between the normal cluster and the at least one alert 
cluster are non crisp. 

77. The system according to clause 73, wherein the classification of normalized data into the normal cluster and 
the at least one alert cluster is based on the degree of confidence that the data belong to the normal cluster and 
the at least one alert cluster. 



78. The system according to clause 73, wherein said alert verifier comprises means for generating a vigilance level 
flag after a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicbus 

10 data reading increases. 

79. The system according to clause 78, wherein said alert verifier verifies an alert condition after a predetermined 
number of vigilance level flags have been generated. 

is 80. A system for validating an alert generated from a trend performance analysis tool used to monitor data obtained 

from an aircraft engine process, comprising: 

a normalizer for normalizing data obtained from said aircraft engine process and monitored by the trend per- 
formance analysis tool; 

20 

a classifier for classifying the normalized data in a multi-dimensional space defined for variables in the aircraft 
engine process, the normalized data being classified into a normal cluster and at least one alert cluster defined 
in the multi-dimensional variable space, wherein the normal cluster is indicative of normal operating conditions 
for said aircraft engine process and the at least one alert cluster is indicative of an alert condition for said 
25 aircraft engine process; and 

an alert verifier for verifying data classified as an alert condition, wherein the verified alert condition is an 
indication that the alert generated from the trend performance analysis tool is valid. 

30 81 . The system according to clause 80, wherein said normalizer comprises means for scaling the data according 

to normalization parameters. 

82. The system according to clause 80, wherein the normal cluster and the at least one alert cluster are of non- 
uniform and non-linear degrading size and shape. 

35 

83. The system according to clause 82, wherein boundaries between the normal cluster and the at least one alert 
cluster are non crisp. 

84. The system according to clause 80, wherein the classification of normalized data into the normal cluster and 
40 the at least one alert cluster is based on the degree of confidence that the data belong to the normal cluster and 

the at least one alert cluster. 



85. The system according to clause 80, wherein the alert verifier comprises means for generating a vigilance level 
flag after a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicbus 

45 data reading increases. 

86. The system according to clause 85, wherein said alert verifier verifies an alert condition after a predetermined 
number of vigilance level flags have been generated. 

50 87. a method for validating an alert generated from a trend performance analysis tool used to monitor data obtained 

from a process, comprising: 

normalizing the data monitored by the trend performance analysis tool; 

55 classifying the normalized data in a multi-dimensional space defined for variables in the process, the normal- 

ized data being classified into a normaJ cluster and at least one alert cluster defined in the multi-dimensional 
variable space, wherein the normal cluster is indicative of normal operating conditions for the process and the 
at least one alert cluster is indicative of an alert condition in the process; and 
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verifying the data classified as an alert condition, wherein the verified alert condition is an indication that the 
alert generated from the trend performance analysis tool is valid. 

88. The method according to clause 87, wherein said normalizing comprises scaling the data according to nor- 
s malization parameters. 

89. The method according to clause 87, wherein the normal cluster and the at least one alert cluster are of non- 
uniform and non-linear degrading size and shape. 

10 90. The method according to clause 89, wherein boundaries between the normal cluster and the alert cluster are 

non crisp. 

91 . The method according to clause 87, wherein the classification of normalized data into the normal cluster and 
the at least one cluster is based on the degree of confidence that the data belongs to the normal cluster and the 

15 at least one cluster. 

92. The method according to clause 87, wherein said verifying an alert comprises generating a vigilance level flag 
after a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious data 
reading increases. 

20 

93. The method according to clause 92, wherein said verifying verifies an alert condition after a predetermined 
number of vigilance level flags have been issued. 

94. A method for validating an alert generated from a trend performance analysis tool used to monitor data obtained 
25 from an aircraft engine process, comprising: 

normalizing the data obtained from said aircraft engine process and monitored by the trend performance anal- 
ysis tool; 

30 classifying the normalized data in a multi-dimensional space defined for variables in the aircraft engine process, 

the normalized data being classified into a normal cluster and at least one alert cluster defined in the multi- 
dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for said 
aircraft engine process and the at least one alert cluster is indicative of an alert condition for said aircraft engine 
process; and 

35 

verifying data classified as an alert condition, wherein the verified alert condition is an indication that the alert 
generated from the trend performance analysis tool is valid. 

95. The method according to clause 94, wherein said normalizing comprises scaling the data according to nor- 
40 malization parameters. 

96. The method according to clause 94, wherein the normal cluster and the at least one alert cluster are of non- 
uniform and non-linear degrading size and shape. 

45 97. The method according to clause 96, wherein boundaries between the normal cluster and the at least one alert 

cluster are non crisp. 

98. The method according to clause 94, wherein the classification of normalized data into the normal cluster and 
the at least one alert cluster is based on the degree of confidence that the data belong to the normal cluster and 

50 the at least one alert cluster. 

99. The method according to clause 94, wherein said verifying comprises generating a vigilance level flag after a 
suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious data reading 
increases. 

55 

100. The method according to clause 99, wherein said verifying verifies an aJert condition after a predetermined 
number of vigilance level flags have been generated. 
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101. A system for validating an alert generated f rom a trend performance analysis tool used to monitor data obtained 
from a process, comprising: 

a normalizer for normalizing the data monitored by the trend performance analysis tool; 

5 

a tracker for tracking the normalized data for drifts that arise over time in the process; 

a classifier for classifying the normalized data in a multi-dimensional space defined for variables in the process, 
the normalized data being classified into a normal cluster and at least one alert cluster defined in the multi- 
10 dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for the 

process and the at least one alert cluster is indicative of alert conditions in the process; and 

an alert verifier for verifying data classified as an alert condition, wherein the verified alert condition is an 
indication that the alert generated from the trend performance analysis tool is valid. 

15 

1 02. The system according to clause 1 01 , wherein said normalizer comprises means for scaling the data according 
to normalization parameters. 

1 03. The system according to clause 1 01 , wherein the normal cluster and the at least one alert cluster are of non- 
20 uniform and non-linear degrading size and shape. 

104. The system according to clause 103, wherein boundaries between the normal cluster and the at least one 
alert cluster are non crisp. 

25 105. The system according to clause 101 , wherein said alert verifier comprises means for generating a vigilance 

level flag after a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious 
data reading increases. 

1 06. The system according to clause 1 05, wherein said alert verifier verifies an alert condition after a predetermined 
30 number of vigilance level flags have been generated. 

107. The system according to clause 101, wherein the tracker comprises means for adapting the locations and 
shapes of the normal cluster and the at least one cluster in the multi-dimensional variable space in accordance 
with the drifting data. 

35 

108. The system according to clause 107, wherein the classifier classifies incoming data in accordance with the 
adapted locations and shapes of the normal cluster and the at least one alert cluster. 

1 09. A system for validating an alert generated from a trend performance analysis tool used to monitor data obtained 
40 from an aircraft engine process, comprising: 

a normalizer for normalizing data obtained from said aircraft engine process and monitored by the trend per- 
formance analysis tool; 

45 a tracker for tracking the normalized data for drifts that arise over time in the process; 

a classifier for classifying the normalized data in a multi-dimensional space defined for variables in the aircraft 
engine process, the normalized data being classified into a normal cluster and at least one alert cluster defined 
in the multi-dimensional variable space, wherein the normal cluster is indicative of normal operating conditions 
so for said aircraft engine process and the at least one alert cluster is indicative of an alert condition for said 

aircraft engine process; and 

an alert verifier for verifying data classified as an alert condition, wherein the verified alert condition is an 
indication that the alert generated from the trend performance analysis tool is valid. 

55 

110. The system according to clause 109, wherein said normalizer comprises means for scaling the data according 
to normalization parameters. 
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111. The system according to clause 109, wherein the normal cluster and the at least one alert cluster are of non- 
uniform and non-linear degrading size and shape. 

112. The system according to clause 111, wherein boundaries between the normal cluster and the at least one 
s alert cluster are non crisp. 

113. The system according to clause 109, wherein the alert verifier comprises means for generating a vigilance 
level flag after a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious 
data reading increases. 

10 

1 1 4. The system according to clause 11 3, wherein said alert verifier verifies an alert condition after a predetermined 
number of vigilance level flags have been generated. 

115. The system according to clause 109, wherein the tracker comprises means for adapting the locations and 
is shapes of the normal cluster and the at least one cluster in the multi-dimensional variable space in accordance 

with the drifting data. 

116. The system according to clause 115, wherein the classifier classifies incoming data in accordance with the 
adapted locations and shapes of the normal cluster and the at least one alert cluster. 

20 

117. A method for validating an alert generated from a trend performance analysis tool used to monitor data ob- 
tained from a process, comprising: 

normalizing the data monitored by the trend performance analysis tool; 

25 

tracking the normalized data for drifts that arise over time in the process; 

classifying the normalized data in a multi-dimensional space defined for variables in the process, the normal- 
ized data being classified into a normal cluster and at least one alert cluster defined in the multi-dimensional 
30 variable space, wherein the normal cluster is indicative of normal operating conditions for the process and the 

at least one alert cluster is indicative of an alert condition in the process; and 

verifying the data classified as an alert condition, wherein the verified alert condition is an indication that the 
alert generated from the trend performance analysis tool is valid. 

35 

11 B. The method according to clause 117, wherein said normalizing comprises scaling the data according to nor- 
malization parameters. 

119. The method according to clause 117, wherein the normal cluster and the at least one alert cluster are of non- 
40 uniform and non-linear degrading size and shape. 

120. The method according to clause 119, wherein boundaries between the normal cluster and the alert cluster 
are non crisp. 

45 121 . The method according to clause 117, wherein said verifying an alert comprises generating a vigilance level 

flag after a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious 
data reading increases. 

122. The method according to clause 121 , wherein said verifying verifies an alert condition after a predetermined 
50 number of vigilance level flags have been issued. 

123. The method according to clause 117, wherein said tracking comprises adapting the locations and shapes of 
the normal cluster and the at least one cluster in the multi-dimensional variable space in accordance with the 
drifting data. 

55 

124. The method according to clause 123, wherein said classifying classifies incoming data in accordance with 
the adapted locations and shapes of the normal cluster and the at least one alert cluster. 
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125. A method for validating an alert generated from a trend performance analysis tool used to monitor data ob- 
tained from an aircraft engine process, comprising: 

normalizing the data obtained from said aircraft engine process and monitored by the trend performance anal- 
5 ysis tool; 

tracking the normalized data for drifts that arise over time in the process; 

classifying the normalized data in a mufti-dimensional space defined for variables in the aircraft engine process, 
10 the normalized data being classified into a normal cluster and at least one alert cluster defined in the multi- 

dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for said 
aircraft engine process and the at least one alert cluster is indicative of an alert condition for said aircraft engine 
process; and 

15 verifying data classified as an alert condition, wherein the verified alert condition is an indication that the alert 

generated from the trend performance analysis tool is valid. 

126. The method according to clause 125, wherein said normalizing comprises scaling the data according to nor- 
malization parameters. 

20 

127. The method according to clause 125, wherein the normal cluster and the at least one alert cluster are of non- 
uniform and non-linear degrading size and shape. 

128. The method according to clause 127, wherein boundaries between the normal cluster and the at least one 
25 alert cluster are non crisp. 

129. The method according to clause 125, wherein said verifying comprises generating a vigilance level flag after 
a suspicious data reading, the vigilance level flag increasing as the number of consecutive suspicious data reading 
increases. 

30 

1 30. The method according to clause 129, wherein said verifying verifies an alert condition after a predetermined 
number of vigilance level flags have been generated. 

131 . The method according to clause 1 25, wherein said tracking comprises adapting the locations and shapes of 
35 the normal cluster and the at least one cluster in the multi-dimensional variable space in accordance with the 

drifting data. 

1 32. The method according to clause 1 31 , wherein said classifying classifies incoming data in accordance with 
the adapted locations and shapes of the normal cluster and the at least one alert cluster. 

40 

Claims 

1. A system (28) for generating an alert from data obtained from a process, comprising: 

45 

a normalizer (30) for normalizing the data; 

a classifier (32) for classifying the normalized data in a multi-dimensional space defined for variables in the 
process, the normalized data being classified into a normal cluster and at least one alert cluster defined in the 
50 multi-dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for 

the process and the at least one alert cluster is indicative of alert conditions in the process; and 

an alert verifier (34) for verifying data classified as an alert condition. 

55 2. A system (28) for generating an alert from data obtained from an aircraft engine (1 2) process, comprising: 

a normalizer (30) for normalizing data obtained from said aircraft engine (12) process; 
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a classifier (32) for classifying the normalized data in a multi-dimensional space defined for variables in the 
aircraft engine process, the normalized data being classified into a normal cluster and at least one alert cluster 
defined in the multi-dimensional variable space, wherein the normal cluster is indicative of normal operating 
conditions for said aircraft engine process and the at least one alert cluster is indicative of an alert condition 
for said aircraft engine process; and 

an alert verifier (34) for verifying data classified as an alert condition. 
A method for generating an alert from data obtained from a process, comprising: 
normalizing the data; 

classifying the normalized data in a multi-dimensional space defined for variables in the process, the normal- 
ized data being classified into a normal cluster and at least one alert cluster defined in the multi-dimensional 
variable space, wherein the normal cluster is indicative of normal operating conditions for the process and the 
at least one alert cluster is indicative of an alert condition in the process; and 

verifying the data classified as an alert condition. 

A method for generating an alert from data obtained from an aircraft engine (12) process, comprising: 

normalizing the data obtained from said aircraft engine process; 

classifying the normalized data in a m ulti-dimensional space defined for variables in the aircraft engine process, 
the normalized data being classified into a normal cluster and at least one alert cluster defined in the multi- 
dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for said 
aircraft engine (1 2) process and the at least one alert cluster is indicative of an alert condition for said aircraft 
engine (12) process; and 

verifying data classified as an alert condition. 

A system (28) for generating an alert from data obtained from a process, comprising: 

a normalizer (30) for normalizing the data; 

a tracker (54) for tracking the normalized data for drifts that arise over time in the process; 

a classifier (32) for classifying the normalized data in a mufti-dimensional space defined for variables in the 
process, the normalized data being classified into a normal cluster and at least one alert cluster defined in the 
multi-dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for 
the process and the at least one alert cluster is indicative of an alert condition in the process; and 

an alert verifier (34) for verifying data classified as an alert condition. 

A system (28) for generating an alert from data obtained from an aircraft engine (12) process, comprising: 

a normalizer (30) for normalizing data obtained from said aircraft engine process; 

a tracker (54) for tracking the normalized data for drifts that arise over time in the aircraft engine process; 

a classifier (32) for classifying the data in a multi-dimensional space defined for variables in the aircraft engine 
process, the data being classified into a normal cluster and at least one alert cluster defined in the multi- 
dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for said 
aircraft engine process and the at least one alert cluster is indicative of an alert condition for said aircraft engine 
process; and 

an alert verifier (34) for verifying data classified as an alert condition. 
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7. A system (28) for validating an alert generated from a trend performance analysis tool (18) used to monitor data 
obtained from a process, comprising: 

a normalizer (30) for normalizing the data monitored by the trend performance analysis tool (18); 

a classifier (32) for classifying the normalized data in a multi-dimensional space defined for variables in the 
process, the normalized data being classified into a normal cluster and at least one alert cluster defined in the 
multi-dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for 
the process and the at least one alert cluster is indicative of alert conditions in the process; and 

an alert verifier (34) for verifying data classified as an alert condition, wherein the verified alert condition is an 
indication that the alert generated from the trend performance analysis tool (18) is valid. 

8. A system (28) for validating an alert generated from a trend performance analysis tool (18) used to monitor data 
is obtained from an aircraft engine (12) process, comprising: 

a normalizer (30) for normalizing data obtained from said aircraft engine (12) process and monitored by the 
trend performance analysis tool (18); 

a classifier (32) for classifying the normalized data in a multi-dimensional space defined for variables in the 
aircraft engine process, the normalized data being classified into a normal cluster and at least one alert cluster 
defined in the multi-dimensional variable space, wherein the normal cluster is indicative of normal operating 
conditions for said aircraft engine process and the at least one alert cluster is indicative of an alert condition 
for said aircraft engine process; and 

an alert verifier (34) for verifying data classified as an alert condition, wherein the verified alert condition is an 
indication that the alert generated from the trend performance analysis tool (18) is valid. 

9. A system (28) for validating an alert generated from a trend performance analysis tool (18) used to monitor data 
30 obtained from a process, comprising: 

a normalizer (30) for normalizing the data monitored by the trend performance analysis tool (18); 

a tracker (54) for tracking the normalized data for drifts that arise over time in the process; 

a classifier (32) for classifying the normalized data in a multi-dimensional space defined for variables in the 
process, the normalized data being classified into a normal cluster and at least one alert cluster defined in the 
multi-dimensional variable space, wherein the normal cluster is indicative of normal operating conditions for 
the process and the at least one alert cluster is indicative of alert conditions in the process; and 

an alert verifier (34) for verifying data classified as an alert condition, wherein the verified alert condition is an 
indication that the alert generated from the trend performance analysis tool (18) is valid. 

10. A system (28) for validating an alert generated from a trend performance analysis tool (18) used to monitor data 
45 obtained from an aircraft engine (1 2) process, comprising: 

a normalizer (30) for normalizing data obtained from said aircraft engine (12) process and monitored by the 
trend performance analysis tool (18); 

so a tracker (54) for tracking the normalized data for drifts that arise over time in the process; 

a classifier (32) for classifying the normalized data in a multi-dimensional space defined for variables in the 
aircraft engine process, the normalized data being classified into a normal cluster and at least one alert cluster 
defined in the multi-dimensional variable space, wherein the normal cluster is indicative of normal operating 
55 conditions for said aircraft engine process and the at least one alert cluster is indicative of an alert condition 

for said aircraft engine process; and 

an alert verifier (34) for verifying data classified as an alert condition, wherein the verified alert condition is an 
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indication that the alert generated from the trend performance analysis tool (18) is valid. 
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